Cloudflare Rust Jobs: Pingora, Workers, and Hiring

Cloudflare is one of the heaviest production Rust users on the internet. Pingora, the proxy that replaced nginx across its network, is written in Rust, along with its QUIC stack, a WireGuard implementation, and parts of Workers. Here is the full picture and how to get hired.

Cloudflare runs Rust at the core of its data plane: the software that terminates and forwards a large share of all web traffic. For a systems engineer, it is one of the best places in the industry to work on Rust that matters.

By Max Wells, updated August 2026

TL;DR

Pingora, Cloudflare's in-house HTTP proxy, is written in Rust and replaced nginx across its global network. It handles trillions of requests per day.

Cloudflare open-sourced Pingora and the Oxy proxy framework grew from the same lineage.

quiche (QUIC and HTTP/3) and boringtun (WireGuard) are Cloudflare Rust projects used in production and widely adopted outside.

Workers, Cloudflare's edge compute platform, has significant Rust in its control and data path.

Hiring is strong and ongoing across data plane, Workers, and security teams.

Does Cloudflare Use Rust?

Yes, extensively, and at a scale few other companies match. Cloudflare's most significant Rust project is Pingora, a framework and proxy it built to replace nginx as the software that sits in front of customer traffic. Cloudflare published a detailed engineering post in 2022 explaining the move: nginx's architecture made connection reuse across its large fleet inefficient, and the codebase was hard to extend safely in C. Pingora, written in Rust, improved connection reuse, cut CPU and memory use, and gave Cloudflare a codebase its engineers could modify without fear of memory-safety bugs. Pingora was open-sourced in 2024.

Rust at Cloudflare did not start with Pingora. The company had already shipped quiche, its QUIC and HTTP/3 implementation, and boringtun, a userspace WireGuard implementation, both in Rust and both used well beyond Cloudflare. Rust is now a default choice for new data plane and edge components.

What Cloudflare Builds With Rust

Pingora. The proxy and the framework. This is the software that terminates TLS and forwards requests for a large fraction of the web. Later work, including the Oxy proxy framework, builds on the same foundations.
quiche. QUIC transport and HTTP/3, embedded in Cloudflare's edge and available as a library. Used by other companies and projects.
boringtun. Userspace WireGuard, the basis for Cloudflare's WARP client data path.
Workers runtime and platform. The edge compute product has Rust across its control plane and in performance-critical parts of the runtime and storage bindings.
Security and parsing components. Firewall rules engines, bot detection features, and content scanning benefit from Rust's safety when handling untrusted input at line rate.

The Evidence

Cloudflare's blog post "How we built Pingora, the proxy that connects Cloudflare to the Internet" (2022) and the open-source release announcement (2024).
The public GitHub repositories for pingora, quiche, and boringtun, all under Cloudflare's organization and actively maintained.
Regular Cloudflare blog posts during "Speed Week" and "Birthday Week" describing Rust rewrites of edge components.
A steady stream of Cloudflare job postings that name Rust as the primary language for data plane and Workers roles.

Hiring Signals

Cloudflare hires Rust engineers continuously. The strongest concentrations are:

Data plane and network teams working on Pingora, proxying, TLS, and transport.
Workers and developer platform teams building the edge runtime, storage, and bindings.
Security engineering teams building detection and filtering that runs inline with traffic.

Typical US total compensation:

Mid-level systems engineer: roughly 170K to 220K USD.
Senior engineer: roughly 230K to 300K USD.
Staff and principal: 320K USD and up.

Cloudflare hires across many locations including Austin, Lisbon, London, and remote roles in several countries. For data plane roles, Rust experience is often an explicit requirement rather than a nice-to-have.

How to Get Hired Onto a Rust Team at Cloudflare

Know the proxy and networking domain. Understand HTTP/1.1, HTTP/2, HTTP/3, TLS termination, connection pooling, and where latency and CPU go in a proxy. Pingora is open source; read it.
Contribute upstream. quiche, pingora, and boringtun accept issues and pull requests. A merged contribution is the single strongest application signal for these teams.
Build something that handles untrusted input safely. A parser, a protocol implementation, or a small proxy. Show fuzzing and benchmarks.
Be comfortable with async Rust under load. Tokio, backpressure, and avoiding lock contention on hot paths.

Frequently Asked Questions

Is Pingora really used for all of Cloudflare's traffic?

Pingora replaced nginx for the large majority of Cloudflare's proxied traffic. Cloudflare has described it handling more than a trillion requests per day.

Can I use Pingora outside Cloudflare?

Yes. Pingora is open source under a permissive license and is used by other companies to build their own proxies.

Does Cloudflare hire Rust engineers without networking experience?

It is possible for Workers and platform roles, but data plane teams strongly prefer candidates who already understand proxies and transport protocols.

What is Oxy?

Oxy is a proxy framework Cloudflare built on top of its Rust proxy work, used internally for a range of forward and reverse proxy applications.

Which Cloudflare open-source Rust project is the best to learn from?

quiche if you want to learn transport protocols, pingora if you want to learn proxy architecture, boringtun if you want a smaller, focused codebase.

Sources

Keep Reading

Last verified: August 2026.